HM Treasury Information Management Assessment (IMA) Action plan

1. HM Treasury (HMT) should further develop its approach to information asset management to gain greater control of its information assets.

- Defining what an information asset is for HMT.
- Considering how it can best document its information assets, drawing on the work that the Knowledge and Information Management (KIM) team is doing to survey and document the digital information that the department holds.
- Developing a method of reporting on assurance of these assets and linking this with the benchmarking process already established for Knowledge Management (KM).
- Defining the Information Asset Owner (IAO) role and considering how this can be better supported through training, guidance and networks.

| Actions to address recommendations and reduce risk | Priority: High / Medium / Low | Owner | Due for completion | Status | Additional commentary | |--------------------------------------------------|-------------------------------|-------|--------------------|--------|-----------------------| | 1A Review, redraft and communicate policy and associated documentation on information risk and asset management. Include a clear definition of what an asset is. | Not applicable | Departmental Records Officer | January 2017 | UNDERWAY | - Revision of RM and security policies undertaken

- Comprehensive policy consolidation exercise underway | | 1B Complete an Information Asset Register and institute a process for maintaining it. | Not applicable | Departmental Records Officer | March 2017 | UNDERWAY | - First draft of register completed

- Resource recruited

- Process to be defined and delivered | | 1C Incorporate measures for asset assurance reporting into the new revision of KM Benchmarking. | Not applicable | Departmental Records Officer | January 2017 | UNDERWAY | - Revision of RM and security policies undertaken

- Review of KM Benchmarking underway | | 1D Allocate a specific resource and develop a support offer for the IAO role. | Not applicable | Departmental Records Officer | October 2016 | UNDERWAY | - Resource recruited

- Offer to be defined | HMT should build on the work it has done so far and continue to develop its approach to the management of both its current and legacy digital information.

- Ensuring that the Information Management Project stays on track and continues to have the support and investment that its needs.

- Addressing issues around structure, access permissions and disposal as part of the Information Management Project.

- Gaining a greater sense of staff practice on the shared and personal drives and email through monitoring and increased reporting, possibly as part of the KM Benchmarking.

- Decommissioning any shared drives that aren’t necessary to ensure maximum take up of Info Store.

- Making sure IT is involved when business areas want to use collaboration and other web tools. Including rules about the use of these systems and capture of record content in the Records Management Policy and related guidance and effectively communicating this to staff.

- Raising staff awareness of how to optimise search within Info Store through guidance and the KM Champions and Site Owners.

- Reviewing the Site Owner role to evaluate whether the right people are carrying out the function and considering how many Site Owners are needed. Ensuring that the role is reflected in their performance objectives, as it is for the Knowledge Champions.

- Continuing to embed the use of Info Store across the organisation through communications, training, guidance and the KM Champions and Site Owners.

- Further consideration of what digital information it can proactively release and engaging with end users to see what would be of value.

- Where additional tools are used by business areas, ensuring that IT is involved in this process and that rules about the use of these systems and capture of record content are included within the Records Management Policy and related guidance and that this is communicated to staff.

| Actions to address recommendations and reduce risk | Priority: High / Medium / Low | Owner | Due for completion | Status | Additional commentary | |--------------------------------------------------|-------------------------------|-------|--------------------|--------|-----------------------| | 2A Complete the IM project as scheduled. Implement the Records Centre (archiving) service as part of the | Not applicable | Departmental Records Officer | October 2016 | COMPLETE | - Project on schedule - Requirements delivered for archiving service | | Action plan | Responsible Officer | Start Date | Status | Progress Notes | |----------------------------------------------------------------------------|---------------------|------------|--------------|--------------------------------------------------------------------------------| | 2B Close down existing file shares as part of the IM project. | Not applicable | December 2016 | UNDERWAY | - Shared drive users identified

- Content migrated
- Plan to reset permissions in place | | 2C Implement a reporting service, to track records storage and quality, as part of the Info Store solution. | Not applicable | December 2016 | UNDERWAY | - Requirements in place
- Build underway | | 2D Implement an extranet facility for safe external collaboration. | Not applicable | November 2016 | UNDERWAY | - Build complete
- Pilot being planned | | 2E Design a communications and change strategy as part of the IM project, to include training and guidance on the Info Store application. | Not applicable | October 2016 | COMPLETE | - Strategy defined and being delivered | | 2F establish a new (smaller) cohort of Site Owners, introduce new mandatory training and continue to sustain the Site Owner community. | Not applicable | October 2016 | COMPLETE | - Smaller group defined
- Training delivered
- Resource in place to support Site Owners | | 2G Review, redraft and communicate policy and associated documentation on records management as part of the IM project. | Not applicable | October 2016 | COMPLETE | - Addressed in the Comms and Change Strategy | HM Treasury Information Management Assessment (IMA) Action plan

3 HMT needs to improve its approach to managing information risk within the wider HMT risk management framework.

- Putting together a description of information risk that reflects that information risk is not just about physical loss of information or cyber-attacks but is also about the ongoing availability and integrity of information and communicating this to staff.
- Ensuring that senior management and IAOs understand the importance of identifying and managing information risk and of the negative impact if information is not managed and protected appropriately through briefings and training.

| Actions to address recommendations and reduce risk | Priority: High / Medium / Low | Owner | Due for completion | Status | Additional commentary | |--------------------------------------------------|-------------------------------|-------|--------------------|--------|-----------------------| | 3A Review, redraft and communicate policy and associated documentation on information risk and asset management. Include a clear definition of what information risk is. | Not applicable | Departmental Records Officer | January 2017 | UNDERWAY | - Revision of RM and security policies undertaken

- Comprehensive policy consolidation exercise underway

- Launch next year | | 3B Actively communicate information risk to SCS. This includes sessions for EMB, Treasury Sub-Committee and the weekly SCS comms meeting. | Not applicable | Departmental Records Officer | October 2016 | COMPLETE | - EMB visited three times since the audit. Includes review of risk appetite and visit by TNA to the Board Sub-Committee

- SCS Comms visited three times, including by TNA

- Group meetings visited | | 3C Establish routine reporting to the SIRO and to the Organisational Risk Group. | Not applicable | Departmental Records Officer | October 2016 | COMPLETE | - Periodic sessions with SIRO scheduled (quarterly)

- Monthly reports to ORG | HMT should continue to invest time and effort in supporting and further developing the KM benchmarking.

- Thinking about how the process will be developed to challenge and motivate high-scoring business areas to continue to drive improvement.

- Exploring whether the process can be used to gather more detailed evidence of information and records management practice in business areas, for example, around use of Info Store, shared and personal drives, filing of emails etc.

- Considering whether information assurance reporting can be linked or incorporated into this process.

| Actions to address recommendations and reduce risk | Priority: High / Medium / Low | Owner | Due for completion | Status | Additional commentary | |--------------------------------------------------|-------------------------------|-------|--------------------|--------|-----------------------| | 4A Substantially revise KM Benchmarking for a fresh approach in Q4 (2016/17). | Not applicable | Departmental Records Officer | January 2017 | UNDERWAY | - Extensive research and consultancy on alternative models - Proposal to Leadership Team in December | | 4B Incorporate the new Info Store reporting service into the revision of KM Benchmarking. | Not applicable | Departmental Records Officer | December 2016 | UNDERWAY | - Requirements in place - Build underway | | 4C Incorporate measures for asset assurance reporting into the revision of KM Benchmarking. | Not applicable | Departmental Records Officer | January 2017 | UNDERWAY | - Revision of RM and security policies undertaken - Review of KM Benchmarking underway | HM Treasury Information Management Assessment (IMA) Action plan

5. HMT should continue to build on the positive work it has done so far in developing an approach for the appraisal, selection, sensitivity review and transfer of digital information.

- Building up a full picture of its digital holdings.
- Applying disposal criteria to legacy and current digital records.
- Developing a method of appraising digital records including the use of Series Level Appraisal Questionnaires (SLAQ).
- Devising an approach to sensitivity reviewing its digital information.
- Deciding how it will transfer digital information and testing this.
- Continuing to engage with The National Archives Information Management Consultant (IMC) and Digital Transfer User Group.
- Sharing knowledge, experience and learning from other government departments; testing and piloting different approaches.
- Publishing guidance on what to keep and/or retention or disposal schedules on GOV.UK.

| Actions to address recommendations and reduce risk | Priority: High / Medium / Low | Owner | Due for completion | Status | Additional commentary | |--------------------------------------------------|-------------------------------|-------|--------------------|--------|-----------------------| | 5A Consolidate our records on the Info Store platform through completing the IM project and closing down shared drives. | Not applicable | Departmental Records Officer | December 2016 | UNDERWAY | - Shared drive users identified

- Content migrated
- Plan to reset permissions in place | | 5B Enable records disposition on the Info Store application by implementing a Records Centre service. | Not applicable | Departmental Records Officer | October 2016 | COMPLETE | - Requirements delivered for archiving service | | 5C Ensure that digital Series Level Appraisal Questionnaires (SLAQs) are approved completed for the entirety of the Panagon collection (1996-2004). | Not applicable | Departmental Records Officer | October 2016 | COMPLETE | - SLAQs completed | | 5D Plan to revisit sensitivity review of the Panagon collection at least three years before scheduled transfer (currently planned as 2022) to allow one year to | Not applicable | Departmental Records Officer | October 2016 | COMPLETE | - SLAQs completed
- Long term transfer plan in place | | Action plan | Responsible Officer | Date | Status | Notes | |---------------------------------------------------------------------------|--------------------------------------|------------|--------------|----------------------------------------------------------------------| | pilot and procure a solution and two years to complete the review task. | | | | | | 5E Publish the HM Treasury Retention and Deletion Policy on GOV.UK. | Not applicable | January 2017 | UNDERWAY | - Comprehensive policy consolidation exercise underway | | 5F Attend National Archives meetings, share expertise across government and participate in Cabinet Office’s digital records project | Not applicable | October 2016 | COMPLETE | - Meetings attended | | | | | | - Presentations given | | | | | | - Project initiation document in place for work with Cabinet Office | HM Treasury Information Management Assessment (IMA) Action plan

6 HMT should continue making positive steps in the management of its paper records, including appraisal, selection and transfer.

- Ensuring that it keeps on track with its transfer plan as agreed by the Advisory Council (AC).
- Carrying on work with Government Remote Services (GRS) on requisitioned records.
- Continuing its good work in managing the relationship with outside contractor/s carrying out management of paper records and accelerated review.

| Actions to address recommendations and reduce risk | Priority: High / Medium / Low | Owner | Due for completion | Status | Additional commentary | |--------------------------------------------------|--------------------------------|-------|--------------------|--------|-----------------------| | 6A Revisit the ACNRA, report on progress and refresh our Retention Instrument (RI). | Not applicable | Departmental Records Officer | October 2016 | COMPLETE | - ACNRA revisited and RI in place | | 6B Declare all records that are misplaced in Department and ensure that the TNA catalogue is updated. | Not applicable | Departmental Records Officer | December 2016 | UNDERWAY | - Work underway, final figures to be confirmed | | 6C List all retained items and extended closures. Return all non-sensitive files to the National Archives and plan to refer and process all sensitive files in the next three years. | Not applicable | Departmental Records Officer | January 2017 | UNDERWAY | - List completed and reviewed - Return of non-sensitive items underway - Planning for sensitive underway | | 6D Review supplier delivery monthly and hold a full contract review annually. | Not applicable | Departmental Records Officer | October 2016 | COMPLETE | - Monthly meetings in place - Annual review in place |